24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

General

Target

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
Size

2.2MB
MD5

8fc2239d034369c87e1d60c833867f28
SHA1

267a4b5e2a12337590a7feff8f351afc46a62ee6
SHA256

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776
SHA512

fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed
SSDEEP

24576:9+GY1v5Px/ZvfKs9/FGAykFFo7oydYqHW9MG0+yGTcMXoOH6W24:9AvlxNfXw3WyMyCMgEG1Lp

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Protector-ivso.exe

pid process

536 Protector-ivso.exe

pid	process
536	Protector-ivso.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4516-133-0x0000000000400000-0x000000000076B000-memory.dmp	upx
behavioral2/memory/4516-138-0x0000000000400000-0x0000000000992000-memory.dmp	upx
behavioral2/memory/536-141-0x0000000000400000-0x000000000076B000-memory.dmp	upx
behavioral2/memory/4516-143-0x0000000000400000-0x000000000076B000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exeProtector-ivso.exe

description	pid	process
Token: SeDebugPrivilege	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
Token: SeDebugPrivilege	536	Protector-ivso.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exeProtector-ivso.exe

pid process

4516 24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
536 Protector-ivso.exe

pid	process
4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
536	Protector-ivso.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe

description	pid	process	target process
PID 4516 wrote to memory of 536	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-ivso.exe
PID 4516 wrote to memory of 536	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-ivso.exe
PID 4516 wrote to memory of 536	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	Protector-ivso.exe
PID 4516 wrote to memory of 820	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe
PID 4516 wrote to memory of 820	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe
PID 4516 wrote to memory of 820	4516	24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe
"C:\Users\Admin\AppData\Local\Temp\24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516

C:\Users\Admin\AppData\Roaming\Protector-ivso.exe
C:\Users\Admin\AppData\Roaming\Protector-ivso.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\24A586~1.EXE" >> NUL
2⤵
PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Protector-ivso.exe
Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-ivso.exe
Filesize
2.2MB

MD5
8fc2239d034369c87e1d60c833867f28

SHA1
267a4b5e2a12337590a7feff8f351afc46a62ee6

SHA256
24a586226fdd2b8d7ca6c3b48bd6c7bd8fdce993d6cee790e0dad51d67261776

SHA512
fafbfecf2b04f16729233720a1df394d265a9e44e4d6f44e9e72731d2d8fc285cbf82f779352eb1622d95c62ddbf3337bc20c84df84c8e3039ec64c043d616ed

Download Submit
memory/536-135-0x0000000000000000-mapping.dmp

Download
memory/536-141-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/536-142-0x0000000074C50000-0x0000000074CE3000-memory.dmp

Filesize
588KB

Download
memory/820-140-0x0000000000000000-mapping.dmp

Download
memory/4516-132-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/4516-133-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4516-134-0x0000000074C50000-0x0000000074CE3000-memory.dmp

Filesize
588KB

Download
memory/4516-138-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/4516-143-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4516-144-0x0000000074C50000-0x0000000074CE3000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads